What is GHSA-7v5r-r995-q2x2?

GHSA-7v5r-r995-q2x2 is a security advisory published by GitHub Security Advisories with Medium severity. SSRF in repository migration

Which CVE IDs does GHSA-7v5r-r995-q2x2 cover?

GHSA-7v5r-r995-q2x2 covers the following CVE IDs: CVE-2022-0870. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7v5r-r995-q2x2?

GHSA-7v5r-r995-q2x2 has a CVSS v3 base score of 5.0, published by GitHub Security Advisories.

Which products are affected by GHSA-7v5r-r995-q2x2?

GHSA-7v5r-r995-q2x2 affects 1 product, including: go/gogs.io/gogs:\u003c 0.12.5.

GHSA-7v5r-r995-q2x2MediumCVSS 5.0

SSRF in repository migration

Vendor

GitHub Security Advisories

Published

March 12, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-0870 →

📋 Description

Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Gogs should be ran in its own private network until users can update.

🎯 Affected products1

go/gogs.io/gogs:< 0.12.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-0870
https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb
https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531
https://github.com/advisories/GHSA-7v5r-r995-q2x2